Assuming that a single core round of MARS can be
run in one clock and that two rounds of the mixing
layer can be run in one clock (to go faster requires
a second S-box, further increasing the gate count),
then a single MARS block can be encrypted or decrypted in 24 clocks. By contrast, the key schedule
of MARS (assuming a single S-box) requires at least
270 clocks, assuming that two linear transformation
steps can be performed per clock. Even if the linear
transformation were free, the key schedule requires
240 clocks, or the time required to encrypt 10 blocks
(i.e., a 160-byte packet!). In other words, a pipelined
approach is actually not sufficient to hide the key
schedule time of MARS